EBA · 2018_4083 Final Q&A

On the application of SCA when cancelling a payment transaction

Regulation
Directive 2015/2366/EU (PSD2)
Article
97, para. 1
Topic
Other topics
Submitted by
Competent authority
Submitted
2018-07-04
Answered
2021-03-12
Answer provided by
ESAs (EBA, ESMA, EIOPA)

Question

Should Account Servicing Payment Service Providers (ASPSPs) apply strong customer authentication (SCA) when cancelling recurring transactions?

Background

As the EBA’s opinion states that the API should allow for (the possibility of cancelling an initiated transaction in accordance with PSD2, including recurring transactions (table 1, line 9, p.3), ASPSPs have asked us whether they had to perform SCA in case a cancellation occurs through a Payment Initiation Service Provider (PISP), because it could be argued that cancellation of a transaction “may imply a risk of fraud or other abuses” as per Article 97.1(c) of PSD2, and therefore should require a SCA as per the same article. This is of importance for ASPSPs and TPPs as: - It could have an impact on the workflows of online banking spaces (for ASPSPs only, ie. should ASPSPs prepare a specific workflow for SCA in case of a cancellation of a transaction?) - it could have an impact on the workflows of the API (i.e should a complementary workflow for SCA in case of cancellation through the API be prepared or not?)

Answer

The act of cancelling a recurrent transaction via a remote channel may imply a risk of fraud or other abuses pursuant to Article 97(1)(c) Directive 2015/2366/EU (PSD2). Therefore strong customer authentication (SCA) is required to cancel a recurrent transaction, including when using a Payment Initiation Service Provider (PISP).   Disclaimer: The answers clarify provisions already contained in the applicable legislation. They do not extend in any way the rights and obligations deriving from such legislation nor do they introduce any additional requirements for the concerned operators and competent authorities. The answers are merely intended to assist natural or legal persons, including competent authorities and Union institutions and bodies in clarifying the application or implementation of the relevant legal provisions. Only the Court of Justice of the European Union is competent to authoritatively interpret Union law. The views expressed in the internal Commission Decision cannot prejudge the position that the European Commission might take before the Union and national courts.

Original source: European Banking Authority, Q&A ID 2018_4083

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

More Q&As on this topic

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

14-day free trial. No credit card required.